CVE-2025-34330: Unrestricted Upload of File with Dangerous Type

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component F2MAdmin that exposes an unauthenticated prompt upload endpoint at AudioCodesfiles/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and...

CVE-2025-34331: Missing Authentication for Critical Function

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request...

PT-2025-47477

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component F2MAdmin that exposes an unauthenticated script-management endpoint at AudioCodes files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-suppli...

CVE-2025-34333: Incorrect Default Permissions

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\F2MAdmin\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process...

PT-2025-47480

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request...

EUVD-2013-6640

Malware in sbrugna...

EUVD-2010-4359

Malware in sbrugna...

EUVD-2010-3000

Malware in sbrugna...

EUVD-2011-4200

Malware in sbrugna...

EUVD-2018-3547

Malware in sbrugna...

EUVD-2015-0712

Malware in sbrugna...

MAL-2025-23485 Malicious code in ivr (npm)

The package ivr was found to contain malicious code...

CVE-2011-4258

RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted length of an MLTI chunk in an IVR file...

CVE-2010-2998

Array index error in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.0.1 allows remote attackers to execute arbitrary code via malformed sample data in a RealMedia .IVR file, related to a "malformed IVR pointer index" issue...

Truist bank confirms data breach

On Wednesday June 12, 2024, a well-known dark web data broker and cybercriminal acting under the name "Sp1d3r" offered a significant amount of data allegedly stolen from Truist Bank for sale. Truist is a US bank holding company and operates 2,781 branches in 15 states and Washington DC. By assets...

CVE-2022-44758

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized...

CVE-2022-44757

BigFix Insights for Vulnerability Remediation IVR uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive information, modify data in unexpected ways, etc...

Input validation

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly authorized...

CVE-2022-44757

BigFix Insights for Vulnerability Remediation (IVR) is documented to use weak cryptography, leading to credential exposure. The vulnerability can allow an attacker to access sensitive information and modify data. Several sources (including NVD/CVE and related aggregations) confirm the weak-crypto...

CVE-2022-44758

CVE-2022-44758 affects BigFix Insights/IVR fixlets with improper credential handling in certain fixlet content. An attacker could access information that is not explicitly authorized. The primary sources indicate this is a vulnerability in fixlet credential handling, but there are no public detai...